Page 251 - Towards Trustworthy Elections New Directions in Electronic Voting by Ed Gerck (auth.), David Chaum, Markus Jakobsson, Ronald L. Rivest, Peter Y. A. Ryan, Josh Benaloh, Miroslaw Kutylowski, Ben Adida ( (z-lib.org (1)

243
An Introduction to PunchScan
2. A mechanism allows the recovery of the candidate choices from only one
page of the ballot
3. The integrity of the election is provable through pre- and post-election audits.
These ideas are common both to PunchScan and to a previous method of David
Chaum’s [Cha]. However, PunchScan is more practical, because it does not suffer
from the perfect alignment problem of the previous method, because the cryp-
tography used is simpler, and because the time required to find the result and
obtain the integrity proof is smaller.
3 High-Level System Design
PunchScan achieves publicly verifiable integrity while maintaining a voter
friendly interface using an optical scan-like ballot. It gives each voter the op-
portunity to take their vote home and check that it is counted in the final tally.
In this section, we first describe the ballot itself, then we present all the phases of
the voting process as seen by all the participants: voters, the election authority,
and candidates.
We assume that the candidates are auditing the election, since they are the
ones that should care most about a correct outcome; in particular, each candidate
would want to check that his rightful votes were not given to another candidate.

3.1 Ballot Design
A ballot consists of two stacked sheets of paper. The top page of the ballot
has holes in it, and the information on the bottom page can be read through
the holes. Both pages also contain all the text needed on the ballot, such as
contests (i.e.: ballot questions) and the candidates’ names. On the top page,
every answer has a symbol assigned to it and the assignment of symbols to
answers varies from ballot to ballot. On the bottom page of the ballot, there is
an (apparently) unordered list of symbols and their order differs from ballot to
ballot. The top and the bottom ballot pages are aligned in such a way that when
they are overlaid, for every question on the ballot, the symbols from the bottom
page are visible through the holes made on the top page (see figure 1(a)).
In PunchScan, the voter uses a dauber to mark the selection of candidates.
A dauber is a pen that leaves a disk of ink on the paper when it makes contact,
just like the ones used by Bingo players to mark the numbers on their tickets.
The diameter of the ink disc is greater then the diameter of the hole punched
through the top page, which means the dauber leaves a mark on both the top
and bottom ballot pages. Figure 1(b) contains a ballot voted for “Yes”.
Because the order of the symbols on the two pages of a ballot is different (and
independent), one cannot determine which mark is for which candidate by view-
ing only one page. We assume that the association of candidates with symbols
and the order of the symbols on the bottom page are uniformly random. Figure
1(c) has the right answer selected on the top layer; depending on which possible
bottom layer is this ballot’s actual bottom layer, that mark could represent a
vote for “Yes” or a vote for “No”, both with a probability of 50%.